Can you install ATP Sensor on a RODC?

%3CLINGO-SUB%20id%3D%22lingo-sub-1475321%22%20slang%3D%22en-US%22%3ECan%20you%20install%20ATP%20Sensor%20on%20a%20RODC%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1475321%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20rolling%20out%20the%20ATP%20Sensor%20to%20all%20our%20DC's%20but%20we%20have%20several%20RODC%20at%20site%20where%20there%20is%20no%20local%20IT%20support.%26nbsp%3B%20We%20are%20using%20the%20gMSA%20method%2C%20we%20get%20an%20error%20when%20we%20try%20to%20run%20the%20%22Install-ADServiceAccount%20gMSAAccount%22%20command.%26nbsp%3B%20Is%20there%20a%20way%20to%20accomplish%20this%3F%26nbsp%3B%20Thanks.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1475410%22%20slang%3D%22en-US%22%3ERe%3A%20Can%20you%20install%20ATP%20Sensor%20on%20a%20RODC%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1475410%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F703997%22%20target%3D%22_blank%22%3E%40cmpaluchadmin%3C%2FA%3E%26nbsp%3B%20as%20far%20as%20installing%20the%20sensor%2C%26nbsp%3B%20there%20is%20no%20problem%20installing%20it%20on%20a%20RODC.%20it's%20even%20recommended%20to%20get%20100%25%20coverage.%3CBR%20%2F%3Especifically%20for%20the%20gmsa%20installation%2C%20I%20am%20not%20sure%2C%20but%20can't%20think%20of%20a%20reason%20why%20an%20existing%20gmsa%20for%20the%20domain%20won't%20work%20here.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

We are rolling out the ATP Sensor to all our DC's but we have several RODC at site where there is no local IT support.  We are using the gMSA method, we get an error when we try to run the "Install-ADServiceAccount gMSAAccount" command.  Is there a way to accomplish this?  Thanks.

1 Reply
Highlighted

@cmpaluchadmin  as far as installing the sensor,  there is no problem installing it on a RODC. it's even recommended to get 100% coverage.
specifically for the gmsa installation, I am not sure, but can't think of a reason why an existing gmsa for the domain won't work here.